On Thu, 02 Jul 2026 16:05:40 +0000
sashiko-bot@kernel.org wrote:

[Severity: High]
This isn't a bug introduced by this patch, but it appears the identical
use-after-free vulnerability you are fixing here remains unpatched in the
equivalent DRM driver.

Does drivers/gpu/drm/omapdrm/dss/dsi.c:omap_dsi_irq_handler() need the same
fix? It still copies the table and drops the lock:

drivers/gpu/drm/omapdrm/dss/dsi.c:omap_dsi_irq_handler() {
    ...
    memcpy(&dsi->isr_tables_copy, &dsi->isr_tables, sizeof(dsi->isr_tables));
    spin_unlock(&dsi->irq_lock);
    dsi_handle_isrs(&dsi->isr_tables_copy, irqstatus, vcstatus, ciostatus);
    ...
}

This could still race with a timeout in dsi_sync_vc_vp(), which creates a
completion on the stack:

drivers/gpu/drm/omapdrm/dss/dsi.c:dsi_sync_vc_vp() {
    DECLARE_COMPLETION_ONSTACK(completion);
    ...
}

Enitities with access to cerebral richness can find the link in the patch
to the version for the drm driver.

Regards,
Andreas